Critical severity · published Aug 15, 2025
CVE-2025-9026
A vulnerability was identified in D-Link DIR-860L 2.04.B04
9.8
CVSS
3.6%
EPSS
No
On KEV
Description
A vulnerability was identified in D-Link DIR-860L 2.04.B04. This affects the function ssdpcgi_main of the file htdocs/cgibin of the component Simple Service Discovery Protocol. The manipulation leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.6% · higher than 89% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DF
Dir-860l Firmware · Dlink
2.04.b04 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-9026
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-9026
Exploit
https://github.com/i-Corner/cve/issues/17
Permissions Required
https://vuldb.com/?ctiid.320091
Third Party Advisory
https://vuldb.com/?id.320091
Third Party Advisory
https://vuldb.com/?submit.629946
Product
https://www.dlink.com/
More from Dir-860l Firmware
9.8
CVE-2018-6530
D-Link Multiple Routers OS Command Injection Vulnerability
9.8
CVE-2024-42812
In D-Link DIR-860L v2.03, there is a buffer overflow vulnerability due to the lack of length verification for the SID field in gena.cgi
9.8
CVE-2024-41611
In D-Link DIR-860L REVA FIRMWARE PATCH 1.10..B04, the Telnet service contains hardcoded credentials, enabling attackers to log in remotely to the Telnet service and perform…
9.8
CVE-2018-20114
On D-Link DIR-818LW Rev.A 2.05.B03 and DIR-860L Rev.B 2.03.B03 devices, unauthenticated remote OS command execution can occur in the soap.cgi service of the cgibin binary via an…
6.5
CVE-2024-37605
A NULL pointer dereference in D-Link DIR-860L REVB_FIRMWARE_2.04.B04_ic5b allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request